South African law lets an AI voice agent cold call a business that is not your customer at most once, and only to ask for consent. POPIA names automatic calling machines in section 69 and protects companies as well as people, and the Information Regulator’s guidance says that one call must carry the contents of Form 4 and record the answer. The opt-out registry whose rules were gazetted on 15 April 2026 sits on top of that rule, not in place of it.
One search about POPIA, B2B cold calling and juristic persons showed my site 1,615 times in 28 days of Search Console data and earned no click. On 5 October 2026 I read the Act in the Government Gazette, the Regulator’s Guidance Note on Direct Marketing and the National Consumer Commission’s draft registry guidelines of 2 October.
With a human caller, the regulator argues that a phone call is stored data. With an AI caller, the Act wrote the definition in 2013.
Key numbers
| Item | Number |
|---|---|
| Consent requests allowed to a non-customer (POPIA section 69(2)) | 1 |
| POPIA administrative fine, maximum (section 109) | R10 million |
| Prison term for ignoring an enforcement notice, maximum (POPIA sections 103 and 107) | 10 years |
| CPA penalty for opt-out registry breaches, maximum (whichever is greater, per the Commission) | R1 million or 10% of turnover |
| Prison term in serious CPA cases, maximum (draft guidelines) | 12 months |
| Opt-out registry regulations gazetted | 15 April 2026 |
| Draft registry compliance guidelines gazetted (15 days for comment) | 2 October 2026 |
| Draft cleansing fee per blocked entry | R0.12 |
| Validity of a cleansed list | 30 days |
| Marketing calls to a consumer at home, weekdays | 08:00 to 20:00 |
| Marketing calls to a consumer at home, Saturday | 09:00 to 13:00 |
| Marketing calls on Sundays and public holidays | 0 hours |
Read on 5 October 2026 from POPIA in Government Gazette 37067, the Information Regulator’s Guidance Note on Direct Marketing, the Consumer Protection Act and its 2011 regulations, the National Consumer Commission’s statement of 17 April 2026 and its draft guidelines in Government Gazette 55465.
The mistake: running South Africa like a US dialer
A US playbook scrubs the do-not-call list and dials every business number left. Three things break that in South Africa.
First, B2B is no exemption. POPIA defines a person as a natural or juristic person, and personal information covers an identifiable, existing juristic person where applicable. The company you call is a data subject, and so is the buyer who answers.
Second, a clean scrub is not consent. On 21 April 2026 the Regulator said people who have not registered a block are still protected by POPIA, and their consent still has to be obtained.
Third, calling from abroad is no safe harbour. POPIA reaches a business outside South Africa that uses automated or non-automated means in the Republic, and it does not say whether an overseas dialer ringing South African numbers counts. Plan as if it does. The email rules are in my South Africa cold email guide.
Scrub the do-not-call list, then call every business number left.
In South Africa a company is a data subject and a clean scrub is not consent.
One recorded consent call, then only the yeses, scrubbed against the registry.
POPIA decides who you may call. The registry decides who you may not.
POPIA already defined your AI agent
Section 69(1) prohibits direct marketing by any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or email, unless the data subject has consented or is your customer. Section 69(5) then defines the machine: one that is able to do automated calls without human intervention. On those words, an AI voice agent that dials and talks with no person on the line is that machine.
A human caller is the harder case. POPIA defines electronic communication as a message stored until the recipient collects it, which fits voicemail better than a live call. The Regulator’s Guidance Note answers that calls now mostly run on VoIP and their voice data packets are stored on the network. The note calls itself advisory. An AI agent needs no argument.
The one call has to be a consent form
Section 69(2) lets you approach a person whose consent you need, and who has not refused it before, only once, and only to request that consent in the prescribed manner and form, which is Form 4 or one substantially similar. The Guidance Note gives the phone version: a caller reads out the contents of Form 4 and records the call, and an automatic calling machine’s recorded message must contain everything in Form 4, offer “I give my consent” or “I do not give my consent”, and record the response.
On the Regulator’s site Form 4 runs to three pages: who is asking, with contact details; the section 69 rule; the Act’s definitions of processing and personal information; the goods and services you want to market; the channel; and the two choices. The note says the first communication must be the consent request, so the pitch waits for the yes.
A no ends it, and the note puts the burden of proving consent on you. Every marketing call after a yes must identify who it is made for and give contact details where the person can ask for the calls to stop. Ignoring an enforcement notice from the Regulator is an offence carrying a fine or up to 10 years in prison, and an infringement notice can carry an administrative fine of up to R10 million.
The opt-out registry sits on top of consent
The Consumer Protection Act gives every person the right to refuse direct marketing, to demand that it stops and to block it in advance through a registry. The amended Regulation 4, gazetted on 15 April 2026, made the National Consumer Commission its administrator. The Commission says every direct marketer must register, and that breaking the rules can draw an administrative penalty of up to R1 million or 10 per cent of annual turnover, whichever is greater.
Its draft compliance guidelines, gazetted on 2 October 2026 with 15 days for comment, add the mechanics. Robocalls, automated calls and other automated dialing count as direct marketing when they promote goods or services. You register before you market, submit your list each month, pay a cleansing fee of 12 cents per entry of a person who has blocked you, and dial from a cleansed list valid for 30 days. The law firm ENS reads the regulations’ fee schedule as R0.12 per data entry, which could mean the whole list. Serious cases can end in prosecution, with up to 12 months in prison.
In the draft, a registered block makes earlier consent invalid, and fresh consent does not override it until the person removes the block. And compliance with the opt-out rules “does not displace the obligations imposed by POPIA”, nor the reverse. You need both lists: the people who said yes, minus the people who blocked you.
Twelve hours on a weekday, four on a Saturday
Section 12 of the Act bars direct marketing to a consumer at home in prohibited periods, and the notice published with the 2011 regulations sets them: no Sundays or public holidays, Saturdays only from 09:00 to 13:00, and other days only from 08:00 to 20:00, unless the consumer has asked for or agreed to other times. That is 12 hours a weekday, 4 on a Saturday and none on a Sunday or public holiday. Proving when a call went out is on you.
A B2B list can hold owners’ and sole traders’ mobiles, so set the agent’s window in South African time for every number and keep the dial timestamp.
Four settings before your agent dials South Africa
Make the first call a Form 4 call
Script the agent to read the Form 4 contents, name the goods and services and the channel, and ask for “I give my consent” or “I do not give my consent”. Record the call and store the answer against the number. This is the consent layer we build in a compliant AI calling setup.
Suppress every no, permanently
One approach per person. Mark a refusal so the agent never dials that number again, and log any request to stop, on whatever channel it arrives.
Register and cleanse every month
Register with the Commission before the first campaign, submit the list each month and dial only from a cleansed list less than 30 days old. Budget 12 cents per blocked entry, or per entry if the fee schedule’s wording holds.
Lock the window to South African time
Weekdays 08:00 to 20:00, Saturdays 09:00 to 13:00, nothing on Sundays or public holidays. If the calls you want are inbound, the draft lists responding to a consumer’s enquiry as an ordinary business engagement, which is where after-hours call answering fits.
The bottom line
South Africa is not closed to AI calling. It is a consent-first market whose privacy law named the automatic calling machine in 2013. Make the agent’s first call a recorded Form 4 request, scrub the list against the registry every month, and let it sell only to people who said yes or already buy from you.